diff --git a/apache2/apache2_config.c b/apache2/apache2_config.c index 34cf8718..d4b2a4bd 100644 --- a/apache2/apache2_config.c +++ b/apache2/apache2_config.c @@ -554,21 +554,24 @@ static const char *add_rule(cmd_parms *cmd, directory_config *dcfg, const char * if (dcfg->tmp_default_actionset == NULL) return FATAL_ERROR; } - /* Merge actions with the parent. */ - rule->actionset = msre_actionset_merge(modsecurity->msre, dcfg->tmp_default_actionset, - rule->actionset, 1); + /* Check some cases prior to merging so we know where it came from */ + /* Must NOT specify a disruptive action in logging phase. */ + if (rule->actionset->phase == PHASE_LOGGING && (rule->actionset->intercept_action != ACTION_ALLOW && rule->actionset->intercept_action != ACTION_NONE)) { + return apr_psprintf(cmd->pool, "ModSecurity: Disruptive actions " + "cannot be specified in the logging phase. %d", rule->actionset->intercept_action); + } + + /* Check syntax for chained rules */ if (dcfg->tmp_chain_starter != NULL) { - /* This rule is part of a chain. */ - /* Must NOT specify a disruptive action. */ - if (rule->actionset->intercept_action == NOT_SET) { + if (rule->actionset->intercept_action != NOT_SET) { return apr_psprintf(cmd->pool, "ModSecurity: Disruptive actions can only " "be specified by chain starter rules."); } /* Must NOT specify a phase. */ - if (rule->actionset->phase == NOT_SET) { + if (rule->actionset->phase != NOT_SET) { return apr_psprintf(cmd->pool, "ModSecurity: Execution phases can only be " "specified by chain starter rules."); } @@ -593,6 +596,13 @@ static const char *add_rule(cmd_parms *cmd, directory_config *dcfg, const char * rule->actionset->phase = rule->chain_starter->actionset->phase; } + /* Merge actions with the parent. + * + * ENH Probably do not want this done fully for chained rules. + */ + rule->actionset = msre_actionset_merge(modsecurity->msre, dcfg->tmp_default_actionset, + rule->actionset, 1); + if (rule->actionset->is_chained != 1) { /* If this rule is part of the chain but does * not want more rules to follow in the chain diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml index 10dba0ae..5dadecf8 100644 --- a/doc/modsecurity2-apache-reference.xml +++ b/doc/modsecurity2-apache-reference.xml @@ -1090,7 +1090,9 @@ SecAuditLogStorageDir logs/audit Dependencies/Notes: Rules following a SecDefaultAction directive will inherit this setting unless a specific action is specified for an indivdual rule or until another - SecDefaultAction is specified. + SecDefaultAction is specified. Take special note that in the logging + disruptive actions are not allowed, but this can inadvertantly be + inherited using a disruptive action in SecDefaultAction. The default value is: @@ -2090,7 +2092,9 @@ SecRule REQUEST_HEADERS:Host "!^$" "deny,phase:1" + available during phase:3 or phase:4. Note that you must be careful + not to inherit a disruptive action into a rule in this phase as this + is a configuration error in ModSecurity 2.5.0 and later versions.